The most obvious reason would be the fear of patching a vulnerability which the attacker used to gain initial access. Persistence is required.

For example, a ransomware gang may compromise a company's network, steal data, deploy the cryptolocker, and then get out. There's no need to have persistent access; they got what they wanted.